ClawHub
Back to skill

Security audit

vargai

Security checks for vulnerabilities and agentic risk

Overview

This media-generation skill is mostly coherent, but it needs Review because it recommends unpinned local code execution and sends user code, prompts, and optional provider keys to external services.

Install only if you are comfortable sending render code, prompts, assets, and possibly provider keys to varg services. Prefer cloud mode for zero local installs, avoid putting secrets or confidential content in render files, use narrowly scoped API keys with spending limits, and pin or preinstall reviewed CLI versions instead of running unpinned `bunx` or pipe-to-shell installer commands.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/setup.sh:133
Finding
Unverified Remote Installer Recommended Through a Pipe-to-Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 133-138 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```bash if [ "$HAS_BUN" -eq 0 ]; then echo " To unlock local render mode, install bun:" dim " curl -fsSL https://bun.sh/install | bash" echo "" fi ``` ### Technical Analysis The setup script prints an installation command that downloads content from `https://bun.sh/install` and immediately executes it with `bash`. The setup script does not execute this command automatically; exploitation requires a user or agent to copy and run the displayed recommendation. Nevertheless, piping a network response directly into a shell creates a remote payload execution channel. The effective code is not contained in this audited project and can change after the audit. There is no version pinning, checksum verification, signature validation, or opportunity to inspect the downloaded script before execution. The `bun.sh` domain is the documented Bun installation source, but HTTPS alone does not provide payload immutability. A compromise of the domain, hosting infrastructure, DNS/TLS trust path, deployment process, or upstream installer could replace the expected installer with arbitrary shell commands. Cloud rendering is already presented as a functional zero-install mode. Consequently, recommending pipe-to-shell installation is not necessary for the Skill's baseline functionality and introduces avoidable supply-chain risk. ### Attack Path 1. An attacker compromises the remote installer source, its deployment credentials, hosting infrastructure, or another component capable of changing the response from `https://bun.sh/install`. 2. A user runs `bash scripts/setup.sh` on a system without Bun. 3. The script displays `curl -fsSL https://bun.sh/install | bash` as the recommended method for enabling local rendering. 4. The user or an automated agent copies and runs that comma ...[truncated 958 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the pipe-to-shell recommendation from the setup output. 2. Direct users to Bun's installation documentation instead of emitting an executable command. 3. If an automated installation path is retained: - Download the installer to a local file. - Pin an expected Bun version. - Obtain checksums or signatures through an independently authenticated channel. - Verify the artifact before execution. - Display the source and require explicit user confirmation. 4. Prefer a trusted operating-system package manager where available. 5. Keep cloud rendering as the default when Bun is absent, because it satisfies the declared media-generation functionality without installing executable software. 6. A safer workflow is structurally similar to: ```bash curl --proto '=https' --tlsv1.2 -fLo bun-install.sh \ https://example.invalid/pinned/bun-install.sh printf '%s %s\n' "$EXPECTED_SHA256" bun-install.sh | sha256sum -c - less bun-install.sh bash bun-install.sh ``` The actual URL, version, and checksum must be pinned to an authenticated official release artifact rather than a mutable installer endpoint. ]]>

T08 · Insecure Dependencies

Warning
Location
references/local-render.md:101
Finding
Unpinned Package Execution Through bunx<![CDATA[ ## Vulnerability Details **File Location**: `references/local-render.md`, lines 101-110 **Vulnerability Type**: Insecure dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash # Preview with free placeholders (validate structure before paying) bunx vargai render video.tsx --preview # Full render (costs credits) bunx vargai render video.tsx --verbose # Force regeneration (bypass cache -- use sparingly, costs $$$) bunx vargai render video.tsx --no-cache ``` Equivalent unpinned `bunx vargai` commands are also recommended in `SKILL.md`, `references/templates.md`, and the output generated by `scripts/setup.ts`. ### Technical Analysis The documented commands invoke the `vargai` package without a fixed version or verified lockfile. Depending on the local project state and Bun's resolution behavior, `bunx` may download and execute the package selected from the configured registry. This combines dependency resolution and code execution into one step. The project does not include a `package.json`, lockfile, package checksum, or provenance policy that establishes which `vargai` release was reviewed and approved. Therefore, a newly published, compromised, or otherwise unexpected package version can become the effective executable even though the Skill's own files have not changed. This is particularly sensitive because rendering is expected to run in an environment containing `VARG_API_KEY` and potentially third-party provider credentials. A malicious package executes locally before or during rendering and is not restricted to the network or filesystem operations required for media generation. ### Attack Path 1. An attacker compromises the registry account, publishing pipeline, maintainer credentials, or package distribution channel for `vargai`. 2. The attacker publishes a malicious release that still exposes a plausible `render` or `hello` command. 3. A user follows the Skill's documented `bunx vargai ...` instruction in a directory ...[truncated 1110 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Add a project manifest and lockfile that pin reviewed versions of `vargai`, `@vargai/gateway`, and related runtime dependencies. 2. Install dependencies separately and run the locked local executable, for example: ```bash bun install --frozen-lockfile bun run vargai render video.tsx --preview ``` 3. If `bunx` must be supported, specify an exact reviewed version rather than an unqualified package name: ```bash bunx vargai@<reviewed-exact-version> render video.tsx --preview ``` 4. Use registry integrity metadata, signed provenance, and automated dependency review in the release process. 5. Configure the package registry explicitly and reject unexpected registries or package sources. 6. Run rendering under a dedicated, unprivileged account or sandbox with access only to the required project directory. 7. Limit credentials exposed to the rendering process: - Supply only the key required for the selected mode. - Use narrowly scoped keys and spending limits. - Avoid exposing unrelated environment variables. 8. Update every repeated command in `SKILL.md`, `references/templates.md`, `references/local-render.md`, and `scripts/setup.ts` so that users are not directed back to the unpinned execution path. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (43)

Ae1

High
Category
analysis-evasion
Content
| Full examples | [templates.md](references/templates.md) | Need complete copy-paste-ready templates |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Cancel Job

```bash
DELETE /v1/jobs/{job_id}
```

---
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
# Or manually:
# 1. Ensure VARG_API_KEY is in .env
echo "VARG_API_KEY=varg_xxx" >> .env

# 2. Quick smoke test
bunx vargai hello
Confidence
88% confidence
Finding
The command `echo "VARG_API_KEY=varg_xxx" >> .env` encourages placing a live credential into a plaintext file without any warning about repository leakage, multi-user systems, backups, or shell-history exposure. While not malicious, this is a real secret-handling weakness because it normalizes insecure storage patterns for users following the documentation.

Credential Access

High
Category
Privilege Escalation
Content
echo "  Then set it:"
  echo "    export VARG_API_KEY=varg_xxx"
  echo "  Or add to .env:"
  echo "    echo 'VARG_API_KEY=varg_xxx' >> .env"
fi

# 2. Check bun
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
echo "  Then set it:"
  echo "    export VARG_API_KEY=varg_xxx"
  echo "  Or add to .env:"
  echo "    echo 'VARG_API_KEY=varg_xxx' >> .env"
fi

# 2. Check bun
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
echo "  Then set it:"
  echo "    export VARG_API_KEY=varg_xxx"
  echo "  Or add to .env:"
  echo "    echo 'VARG_API_KEY=varg_xxx' >> .env"
fi

# 2. Check bun
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High
Category
Supply Chain
Content
dim "    bunx vargai render video.tsx --verbose   (full render)"
  echo ""
  echo "  Cloud render (via API):"
  echo "  $(dim '  curl -X POST https://render.varg.ai/api/render \')"
  echo "  $(dim '    -H "Authorization: Bearer $VARG_API_KEY" \')"
  echo "  $(dim '    -H "Content-Type: application/json" \')"
  echo "  $(dim '    -d '\''{"code": "..."}'\''')"
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High
Category
Privilege Escalation
Content
if (hasTsconfig) console.log(green("  ✓ tsconfig.json exists"))
else console.log(dim("  ○ No tsconfig.json (optional for simple templates)"))

if (hasEnv) console.log(green("  ✓ .env exists"))
else console.log(yellow("  ○ No .env file -- create one with your API keys"))

// 5. Create example file if none exists
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
if (hasTsconfig) console.log(green("  ✓ tsconfig.json exists"))
else console.log(dim("  ○ No tsconfig.json (optional for simple templates)"))

if (hasEnv) console.log(green("  ✓ .env exists"))
else console.log(yellow("  ○ No .env file -- create one with your API keys"))

// 5. Create example file if none exists
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
if (hasTsconfig) console.log(green("  ✓ tsconfig.json exists"))
else console.log(dim("  ○ No tsconfig.json (optional for simple templates)"))

if (hasEnv) console.log(green("  ✓ .env exists"))
else console.log(yellow("  ○ No .env file -- create one with your API keys"))

// 5. Create example file if none exists
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
if (hasTsconfig) console.log(green("  ✓ tsconfig.json exists"))
else console.log(dim("  ○ No tsconfig.json (optional for simple templates)"))

if (hasEnv) console.log(green("  ✓ .env exists"))
else console.log(yellow("  ○ No .env file -- create one with your API keys"))

// 5. Create example file if none exists
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly instructs use of shell commands, environment variables, and outbound network access, but it does not declare any tool scope or allowed-tools boundaries. That creates an authorization gap where an agent may invoke more capability than users or the platform expect, increasing the chance of unintended command execution or data egress.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are broad and overlap with common creative requests like "generate image" or "create a video," which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance that an agent will unnecessarily request API-backed rendering, shell usage, or external transmission when a simpler or safer response would suffice.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Submit TSX code to the render service
curl -s -X POST https://render.varg.ai/api/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code": "const img = Image({ model: fal.imageModel(\"nano-banana-pro\"), prompt: \"a cabin in mountains at sunset\", aspectRatio: \"16:9\" });\nexport default (<Render width={1920} height={1080}><Clip duration={3}>{img}</Clip></Render>);"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Pass BYOK headers alongside your `Authorization` header:

```bash
curl -X POST https://api.varg.ai/v1/image \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "X-Provider-Key-Fal: $FAL_KEY" \
  -H "Content-Type: application/json" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document instructs users to send TSX code and generated-media requests to a remote cloud render service, but it does not clearly warn that prompts, code, and referenced assets will be transmitted to and processed by external infrastructure. In a skill context, this omission can mislead users into sharing sensitive content or proprietary material without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The file states that the user's VARG_API_KEY is automatically used for all downstream AI generation calls, but it does not provide a clear warning that the credential authorizes remote provider usage and billing-sensitive operations. This creates a risk of unintended third-party processing and charges, especially if users assume the key is only used for the primary render endpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 2: Submit to render service

```bash
curl -s -X POST https://render.varg.ai/api/render \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"code\": $(cat video.tsx | jq -Rs .)}"
Confidence
88% confidence
Finding
This command explicitly sends locally authored TSX code to an external HTTPS endpoint together with an authorization token. While remote rendering is the intended feature, the documentation lacks safety framing about external transmission, so users may unknowingly submit sensitive code, prompts, or embedded data to a third-party service.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
This markdown file describes using BYOK headers to bypass billing and later instructs users to set provider API keys in `.env`, but it does not include any warning about handling credentials securely or the billing/privacy implications of sending requests with user-supplied keys. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation states that file uploads return a public URL but does not clearly warn users that uploaded content becomes publicly accessible. This can lead to accidental exposure of sensitive media, credentials embedded in files, or proprietary assets if users assume uploads are private by default.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The BYOK guidance instructs users to send third-party provider API keys to the gateway service but does not prominently warn that those secrets are being transmitted to and processed by varg infrastructure. This creates a significant secret-handling risk because users may not realize they are delegating trust and exposure of provider credentials to an intermediary service.

External Transmission

Medium
Category
Data Exfiltration
Content
Use your own provider API keys for $0 varg billing. Pass keys as headers alongside your `Authorization` header:

```bash
curl -X POST https://api.varg.ai/v1/image \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "X-Provider-Key-Fal: $FAL_KEY" \
  -d '{"model": "nano-banana-pro", "prompt": "a sunset over mountains"}'
Confidence
92% confidence
Finding
The documented curl command sends sensitive credentials to an external gateway endpoint, including a third-party provider key. In the context of a skill that may be copied directly by users, this is materially risky unless the documentation clearly explains the trust implications and safe secret-handling practices.

External Transmission

Medium
Category
Data Exfiltration
Content
Use your own provider API keys for $0 varg billing. Pass keys as headers alongside your `Authorization` header:

```bash
curl -X POST https://api.varg.ai/v1/image \
  -H "Authorization: Bearer $VARG_API_KEY" \
  -H "X-Provider-Key-Fal: $FAL_KEY" \
  -d '{"model": "nano-banana-pro", "prompt": "a sunset over mountains"}'
Confidence
92% confidence
Finding
The documented curl command sends sensitive credentials to an external gateway endpoint, including a third-party provider key. In the context of a skill that may be copied directly by users, this is materially risky unless the documentation clearly explains the trust implications and safe secret-handling practices.

Session Persistence

Medium
Category
Rogue Agent
Content
Renders take 3-15+ minutes. Run in the background to avoid blocking:

```bash
nohup bunx vargai render video.tsx --verbose > output/render.log 2>&1 &
echo "PID: $!"

# Check progress
Confidence
65% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
Renders take 3-15+ minutes. Run in the background to avoid blocking:

```bash
nohup bunx vargai render video.tsx --verbose > output/render.log 2>&1 &
echo "PID: $!"

# Check progress
Confidence
65% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/setup.ts:25